According to your records retention schedule, how long do you keep
security/user access records?


-----Original Message-----
From: Records Management Program [mailto:[log in to unmask]] On Behalf
Of Larry Medina
Sent: Wednesday, March 05, 2014 12:40 PM
To: [log in to unmask]
Subject: Re: Backup Tapes

On Wed, Mar 5, 2014 at 6:04 AM, Callen, Jeanne M
<[log in to unmask]>wrote:

> Good morning all,
>
> The question of backup tapes and their destruction certificates has once
> again come up at our company.  I have always viewed the backup tapes as a
> recovery medium - not a records storage medium - therefore they are not
> listed on our record retention schedule.  On occasion a tape needs to be
> destroyed and we receive a destruction certificate - should the
destruction
> certificate be added to a schedule if the tapes aren't?
>
> I know this is a hot topic on the list so please be kind - I've had a
> rough week.
>
> Frozen in Wisconsin,
> Jeanne
>

I'm sure this topic, like many in RM, will come with a whole host of
opinions.  Some of them will be valid based on whether you operate in a
public or private setting, others based on how highly regulated you are and
others yet on how risk averse or tolerant you are.

One thing to keep in mind is if you ever get into an e-discovery situation,
and you're called upon to produce a data map, your backup tapes will have
to be included on that... because even though they are intended 'solely for
the purpose of system recovery', they DO contain electronically stored
data, and are generated in the course of normal operations.

I think discussing this aspect with your IT/IS staff who are responsible
for the policy, process and procedures related to generating, maintaining,
storing and disposing of backups, will be beneficial.  If a tape is only
retained until the data on it is "stale" and it is then replaced with anew
generation of tape, and these generations are eventually overwritten and
subsequently destroyed, having knowledge of the fact that content on them
may be 'discoverable' may change the procedure.

There have been court rulings in favor of and against having to search and
produce content from backup tapes- and there's no way of knowing how a
Judge is going to rule - the FRCP sets the guidance on what governs the
decision, but if the Judge feels a party hasn't done enough to produce
information and that it MAY exist on those tapes, they can at least require
a "peek into them".

Federal Rule of Civil Procedure Rule 26(b)(2)(B) limits the production of
electronically stored information as follows:

 (B) Specific Limitations on Electronically Stored Information. A party
need not provide discovery of electronically stored information from
sources that the party identifies as not reasonably accessible because of
undue burden or cost. On motion to compel discovery or for a protective
order, the party from whom discovery is sought must show that the
information is not reasonably accessible because of undue burden or cost.
If that showing is made, the court may nonetheless order discovery from
such sources if the requesting party shows good cause, considering the
limitations of Rule 26(b)(2)(C). The court may specify conditions for the
discovery.


The guidance that should exist for rotation and deletion/overwriting of
content on backup tapes should revolve around the shortest time possible
that the content remains viable for reconstituting the system.  If full
backups are made, as soon as a new one is generated, the content of the
prior one becomes less valuable.  If incremental backups are made, then
decisions have to be made to determine when the last full backup becomes so
stale that it would take too much effort to reconstitute from the full
backup and have to add in all of the incremental data.

As to the question about retaining the destruction notices?  My opinion is
YES, they should be retained, in part because the demonstrate that you were
following the policy related to the backup rotation/cycling. Secondly,
because although as you stated they are not "a records storage medium",
they DO contain records and because you maintain records of the disposition
of records in other forms, this would be no different. In our case, we
follow the guidance in NARA GRS 16, item 2 (a) 2 which is to retain for 6
years.

Larry
[log in to unmask]
-- 


*Lawrence J. Medina Danville, CARIM Professional since 1972*

List archives at http://lists.ufl.edu/archives/recmgmt-l.html
Contact [log in to unmask] for assistance
To unsubscribe from this list, click the below link. If not already present,
place UNSUBSCRIBE RECMGMT-L or UNSUB RECMGMT-L in the body of the message.
mailto:[log in to unmask]

List archives at http://lists.ufl.edu/archives/recmgmt-l.html
Contact [log in to unmask] for assistance
To unsubscribe from this list, click the below link. If not already present, place UNSUBSCRIBE RECMGMT-L or UNSUB RECMGMT-L in the body of the message.
mailto:[log in to unmask]